add a couple of bugs about posix compliance and the use of getopts

[monkeysphere.git] / src / monkeysphere-server

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 0815b32142d40710feab28496a0087a06419d49b..c4f69850c7650ca9928ad69e701aee45039c9ad0 100755 (executable)
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -117,6 +117,16 @@ gpg_authentication() {
     su_monkeysphere_user "gpg $@"
 }
 
+# function to check for host secret keys
+# fails if host sec key exists, exits true otherwise
+check_host_keyring() {
+    if ! gpg_host --list-secret-keys --fingerprint \
+       --with-colons --fixed-list-mode 2>/dev/null | grep -q '^sec:' ; then
+
+       failure "You don't appear to have a Monkeysphere host key on this server.  Please run 'monkeysphere-server gen-key' first."
+    fi
+}
+
 # output just key fingerprint
 fingerprint_server_key() {
     gpg_host --list-secret-keys --fingerprint \
@@ -132,13 +142,13 @@ show_server_key() {
     fingerprint=$(fingerprint_server_key)
     gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
 
-    # dumping to a file named ' ' so that the ssh-keygen output
-    # doesn't claim any potentially bogus hostname(s):
-    tmpkey=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
-    gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
+    # do some crazy "Here Strings" redirection to get the key to
+    # ssh-keygen, since it doesn't read from stdin cleanly
     echo -n "ssh fingerprint: "
-    (cd "$tmpkey" && ssh-keygen -l -f ' '
-    rm -rf "$tmpkey"
+    ssh-keygen -l -f /dev/stdin \
+       <<<$(gpg_authentication "--export $fingerprint" | \
+       openpgp2ssh "$fingerprint" 2>/dev/null) | \
+       awk '{ print $1, $2, $4 }'
     echo -n "OpenPGP fingerprint: "
     echo "$fingerprint"
 }
@@ -337,6 +347,7 @@ gen_key() {
     userID="ssh://${hostName}"
 
     # check for presense of key with user ID
+    # FIXME: is this the proper test to be doing here?
     if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
        failure "Key for '$userID' already exists"
     fi
@@ -399,7 +410,11 @@ EOF
     (umask 077 && \
        gpg_host --export-secret-key "$fingerprint" | \
        openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
-    log info "private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
+    log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
+    gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+    log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 }
 
 # extend the lifetime of a host key:
@@ -407,10 +422,6 @@ extend_key() {
     local fpr=$(fingerprint_server_key)
     local extendTo="$1"
 
-    if [ -z "$fpr" ] ; then
-       failure "You don't appear to have a MonkeySphere host key on this server.  Try 'monkeysphere-server gen-key' first."
-    fi
-
     # get the new expiration date
     extendTo=$(get_gpg_expiration "$extendTo")
 
@@ -705,6 +716,10 @@ diagnostics() {
                echo " - Recommendation: remove the above HostKey lines from $sshd_config"
                problemsfound=$(($problemsfound+1))
            fi
+
+        # FIXME: test (with ssh-keyscan?) that the running ssh
+        # daemon is actually offering the monkeysphere host key.
+
        fi
     fi
 
@@ -851,9 +866,9 @@ add_certifier() {
     # export the key to the host keyring
     gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
 
-    if [ "$trust" == marginal ]; then
+    if [ "$trust" = marginal ]; then
        trustval=1
-    elif [ "$trust" == full ]; then
+    elif [ "$trust" = full ]; then
        trustval=2
     else
        failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
@@ -986,6 +1001,7 @@ shift
 
 case $COMMAND in
     'update-users'|'update-user'|'u')
+       check_host_keyring
        update_users "$@"
        ;;
 
@@ -994,22 +1010,27 @@ case $COMMAND in
        ;;
 
     'extend-key'|'e')
+       check_host_keyring
        extend_key "$@"
        ;;
 
     'add-hostname'|'add-name'|'n+')
+       check_host_keyring
        add_hostname "$@"
        ;;
 
     'revoke-hostname'|'revoke-name'|'n-')
+       check_host_keyring
        revoke_hostname "$@"
        ;;
 
     'show-key'|'show'|'s')
+       check_host_keyring
        show_server_key
        ;;
 
     'publish-key'|'publish'|'p')
+       check_host_keyring
        publish_server_key
        ;;
 
@@ -1018,14 +1039,17 @@ case $COMMAND in
        ;;
 
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
+       check_host_keyring
        add_certifier "$@"
        ;;
 
     'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
+       check_host_keyring
        remove_certifier "$@"
        ;;
 
     'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
+       check_host_keyring
        list_certifiers "$@"
        ;;